Ducktail Malware Operation Evolves with New Malicious Capabilities

The operators of the Ducktail data stealer have shown a “relentless willingness to persist” and continued to update their malware as part of an ongoing fiscally driven marketing campaign.

“The malware is designed to steal browser cookies and just take advantage of authenticated Fb classes to steal data from the victim’s Fb account,” WithSecure researcher Mohammad Kazem Hassan Nejad claimed in a new analysis.

“The procedure in the end hijacks Fb Business accounts to which the target has sufficient obtain. The threat actor makes use of their acquired obtain to operate adverts for financial gain.”

Attributed to a Vietnamese risk actor, the Ducktail campaign is made to goal businesses in the electronic advertising and marketing and marketing sectors which are active on the Fb Advertisements and Organization platform.

Also focused are people in just possible providers that are most likely to have superior-stage access to Fb Business enterprise accounts. This includes marketing, media, and human resources personnel.

The destructive activity was first documented by the Finnish cybersecurity firm in July 2022. The operation is believed to be underway considering the fact that the 2nd half of 2021, whilst evidence details to the threat actor currently being active as far back again as late 2018.

A subsequent analysis by Zscaler ThreatLabz last month uncovered a PHP edition of the malware dispersed as installers for cracked software package. WithSecure, even so, reported the activity has no connection in any respect to the campaign it tracks underneath the Ducktail moniker.

The most up-to-date iteration of the malware, which resurfaced on September 6, 2022, soon after the danger actor was compelled to halt its functions on August 12 in response to general public disclosure, arrives with a host of enhancements incorporated to circumvent detection.

An infection chains now commence with the supply of archive information containing spreadsheet paperwork hosted on Apple iCloud and Discord by platforms like LinkedIn and WhatsApp, indicating diversification of the risk actor’s spear-phishing tactics.

The Fb Enterprise account info gathered by the malware, which is signed working with digital certificates acquired under the guise of seven diverse non-existent corporations, is exfiltrated applying Telegram.

“An intriguing shift that was noticed with the newest marketing campaign is that [the Telegram command-and-control] channels now contain multiple administrator accounts, indicating that the adversary may well be managing an affiliate method,” Nejad spelled out.

Located this posting attention-grabbing? Comply with THN on Facebook, Twitter  and LinkedIn to study extra distinctive content we publish.

Some parts of this article are sourced from:
thehackernews.com